https://th3b0ywh0l1v3d.github.io/tags/path-traversal/ Recent content in Path-Traversal on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/dotdotslashflagtxt/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/dotdotslashflagtxt/ Classic path traversal — the challenge name tells you exactly what to do. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/solarity/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/solarity/ Path traversal via /view?file=../flag.txt reads the server-side flag file. https://th3b0ywh0l1v3d.github.io/thm/el-bandito/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/el-bandito/ An exposed Spring Boot Actuator plus an nginx /.;/ path-ACL bypass leaks admin creds and the first flag; an HTTP/2 H2.CL desync then captures an internal bot’s request, stealing its flag cookie. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/reversing/leftover-leftovers/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/reversing/leftover-leftovers/ A two-stage Java AOT-cache app whose integrity hash covers bytecode and pointers but not the archived heap — patching the pre-resolved heap String redirects the image directory and reads /flag.